CVE-2025-2310

low-risk

Published 2025-03-14

A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.

Do I need to act?

0.05% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Hdf5

Affected Vendors

Hdfgroup

References (4)

Exploit https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md

Permissions Required https://vuldb.com/?ctiid.299723

Third Party Advisory https://vuldb.com/?id.299723

Third Party Advisory https://vuldb.com/?submit.514533

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal